Creates strong passwords on your device. Pick a type below, then press Generate. Passwords are kept only until you close or reload, unless you export them.
Security Warnings:
Settings
Balanced security for most online accounts. Good mix of complexity and usability.
Maximum security with 20+ characters, all character types, and no dictionary words.
Long and random. Email accounts are prime targets, because they can reset your other passwords.
Compliance-focused with common corporate policy requirements.
Easy to share verbally while maintaining good security.
Long random password for service and database credentials.
Manual settings below. Use this for specific requirements.
The only feature that uses the network. Your password is not sent — only the first 5 characters of its hash.
Your device hashes the password locally (SHA-1) and sends only the first 5 characters of that hash to the Have I Been Pwned Pwned Passwords API (api.pwnedpasswords.com). That prefix is shared by hundreds of different leaked passwords, so it does not identify yours. This is called k‑anonymity.
HIBP returns every hash ending that starts with those 5 characters, and your device does the matching. The password itself and the full hash never leave this device. Like any web request, it reveals your IP address to that service.
Untick the box and generating, analysing, QR codes, speech and history make no network requests at all. Speech uses only a voice your device reports as on-device; if there is none, the password is not spoken.
The app's own files (page, font, word lists) load from this site, which is hosted on Netlify. There are no analytics, ads or third-party scripts.